D:\Mu\ex902\source\GmEditor\vipshell\2013_duozijie\VipShell\Release\VipShell.pdb
Behavioral task
behavioral1
Sample
f9af2a9422e74230281643729872b3cf_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f9af2a9422e74230281643729872b3cf_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f9af2a9422e74230281643729872b3cf_JaffaCakes118
-
Size
484KB
-
MD5
f9af2a9422e74230281643729872b3cf
-
SHA1
75e77ddacd856238b7ce5e7797ca4a2f9e49e668
-
SHA256
9823bbf97622788a04410edf424f9a7f2b6ee096fd772593ee593c2023c9f676
-
SHA512
9899f10c36b77aca0b2cea5236ac353eb4ed190fcb9dffc3414b4ec6d93929ff3b77d9386c9c5d7f3e75f38c363d3830cc633617a94700cf0242784ff83ceb8b
-
SSDEEP
12288:dLtyVu2c4JySung2dUzNfUVkDaALS0/3A/6d422JRB:Wu2c4JySULdyfZpoF22Z
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9af2a9422e74230281643729872b3cf_JaffaCakes118
Files
-
f9af2a9422e74230281643729872b3cf_JaffaCakes118.dll windows:5 windows x86 arch:x86
7577c4d46fbe2143d773285d024fda9b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetVersionExA
GetSystemDirectoryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextA
advapi32
RegSetValueExA
ole32
CoInitialize
shell32
ShellExecuteA
oleaut32
VariantInit
ws2_32
gethostbyname
avicap32
capGetDriverDescriptionA
gdi32
CreateCompatibleDC
psapi
GetModuleFileNameExA
wininet
InternetCloseHandle
Exports
Exports
2�*��3 8��_�ƪŀ�$��P���f$��J��W�'����--^&���1)@�`���J���8& ��,�d7��s���4x�l����[�r����9F>���/c�|n�S<&Za2�Όo��XW�h�:^GY*T]�b��R��́I8��cߵ ��iX�e�}d�����N��xJs�Z�KBa�.���C6���Ëu��44�Z�8�|'����w ��f-f[¬A/�ᝮ��~ל]��"Q�����0�>����|5�ғ�'��LO���)ђ_��lv�P���9;fioz���H��3DO ��Q�����u1�t�J��(��Zq��\�����C����P�Ho�GC�@�e���g�-�Y��7V��zN9�(Vy�E윒�+���4l,Vf��rmm�P dp����^M��/��\� yY�*?�r�g�~0>��b�9�Wݫ}6����Ş�Pz3�\�������O�H���V��kB���\�a���pn��#���bD�X�^�)��8U��|{ ������*@��I���=�h�2Ƥ�0I^�7��t���8w���#2j��ژ�z �)�-IRկ��om���W�*�T�c����zY%'���G��S�Q?c�G�r23f�Z :Fqs������|�5-��l*7�1�V! ����I��]�<|�mPb��v��2'��O>C�"���kY�q���Yy�*�!;��J��֨X��&"��W���aBfS¸3@ˤ8ӟǣ��F80G����Y���es=��f>�8��w�<����n�sdWՌQ�� (i�]ںm�C�tֺ��H5!�����>��Ck��^j/���gs<�{��5�7���b�d�i*���#�H5�����(�f�� ��IN �r��g��l~X'z�6?|H֘�Kk����A���Z�6��2'��g)�Z����>�l||�[�����K1��a5_�$�7_.h�*��>�}�*s6Զ�&h�A��[�>�ބa�CPHƃ֬�S�yRl�d�.i���(M����Us]��C)����}p���~ǝKzA��D6M4)DXCo�D@�9��I�9�眙j�ܵry��#I�\�p�V�T4[(%���M�6(-r��o���L'��L|u�~-Pr�o�B������e��� 3C2��-}��'���LOt�_���u�!p����G����� �*�0���/�ƛ�MQ_ºI�+O�鈕�Qoq�0���f�@�rǠVv�~B�6��Z��<9��P��st���Ϯ���WL $�I�!�k�������Pr8O| �����BmƁe�d�*��您 �W�l��e͓��cg��� mv��K�A�~@�;r�☌$�$D\N�yB�v�sW��_Cy��'��z��W|�'?:BMh� �ԽxRC������á���������Ր�^��*��d�c��Y\ߍ����!;���ٯ�;"8���7u��9N�M����]�!����Y�Wc%��(L�o�)�>��UW�6 �>k4� B=����� b%H��aRU�٫��2��3·�k���078㧰kȱ�����Y�B��!.Y�����t�h���߅��xDg�� ہ�H���!�9�,4�&M����O�s�S��91 a���H��%�����)6�rF1�P�[x��(i�d�W.�M�|�X�e�y/������O� ������ NE����xs�پ��2J+Dp5�l�ߣ���ݓ���γF��( \���-��:� �X|��TX�B�/q�H��:���%Й��n�rV�6�����yw`o��6���?{��fJ"LX���6f��C�O�0a���JS(�H-���m/�8�V|m���r�J�Ż��`v/Q'��� k�5��'�ڥ/�U���^a��߆�O��Է#�j���3������K���̫����dz~E���E�,��w���o���x��29m3���K����nd�#���YrXҢ��J���p;f62~�.=�ط�T���Ѭ�̩�a�����1�˸�>)y� �Z��\+�E��U��4�&�+�������/�/���b���k�$2�O�V��k%^t�NP���6A�'��d[�_9sk�Wf�r<X���p+m�Cİb!�kӸa�ɊN��-pU�����D:��ul�Bi�{<L��q܋��H`g�Z���«���vٹ�b��(��(�YA����C�L{���R_v��h-����R�&>rA�|��"��e��I�!��KZ�>�`�5dἧg�_\1'�����\xG�p�$j@9�z0,��5.��G��"��Ìj?�캐9i,Xa�at�&��_�2/�67�.���7��V[W^�Z.�/\ �gn�g>��:���k��e|o���q�1S�ֱ4����(I�J���?�LX�S�5�gPJ"����7Ȍ*w�L��qR�!ޓ�g��RF�� ����y�J�tF���9eM��8+�hY�H�*�p�9��(}N�vq��T�?�}��ND2�Ǹ8s�% v�#y�*OO,b���p(D*I��$WNN�`#��'C��V�~��1�X�H�f� 58S(Ě?t��| wre� ��l^n���yΡ� ��X�x���g��� �1y��w V\�"Ǖ���v;֜}�B��Ƞ�q6@�F��)�����g!�lgcN-��8��m-�M�yuC3wQ����F� ���;��R$��tWu`&S�S�A�Hj��� !�qߨ2�Iu�`S��j�@z��'�ښ�Y]@"(�����l(jQT��26d�%����z؈ �����^���a��F �<���B����9��$F[}��@y���\>�k��R�O���q�&Iօ�Q����)�����)���0�1H�@�� �*�h�����9$��tӚCz�NZ��� q�u�AXK��B3<TX�� �V�ւ�*���#ഝ��6�(����Y|a������DQ�� QiGB�_��GQ�WX=&'p*n�?K_]T���J
DoItYourSelf
DownCtrlAltDel
GetDllModuleControl
StartServer
WaitServer
Sections
.text Size: - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VipShel Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 311KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 480KB - Virtual size: 480KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ